- Final Ratified Text
- [Final Text of the AI Act is out: Our Initial Thoughts
- Final text summary
- The Act prohibits AI systems that use harmful subliminal techniques, exploit vulnerabilities, infer sensitive traits, unfairly evaluate individuals, and certain uses of biometric and emotion recognition, with exceptions for law enforcement. It also restricts AI systems for criminal risk assessment and broad data scraping.
- A substantial change is that AI systems will not be considered high-risk if they do not pose a significant risk of harm subject to certain criteria being fulfilled (even if it’s listed as a high-risk system).
- High-risk AI systems are defined based on their potential harm to health, safety, and fundamental rights. Providers must document assessments and register these systems, continually evaluating risks based on various factors. It is for providers to assess whether or not their systems are high risk, and even if they aren’t, registration will still be required to this effect along with record keeping of your assessment.
- General Purpose AI models are introduced with a whole new chapter dedicated to them. Models used for research, development, or prototyping are excluded. Providers of high-risk models must comply with specific standards and appoint an EU representative if based outside the EU.
- Deep fakes must be disclosed as AI-generated, with some exceptions.
- Human oversight for high-risk systems is required, ensuring trained personnel are involved.
- Employers using high-risk AI in the workplace must inform their workers, adhering to EU and national laws.
- Testing of high-risk AI systems in real-world conditions is permitted under strict ethical and consent guidelines.
- High-risk system providers must have agreements with third-party suppliers.
- Simplified technical documentation requirements are in place for SMEs, with a 10-year record-keeping mandate.
- The Act defines AI systems as machine-based systems that influence environments through various outputs.
- Emotion and facial recognition systems are broadly defined, potentially impacting organisations using biometric data for sentiment analysis and law enforcement’s use of real-time facial recognition.
- Data governance focuses on the collection processes, origins, and purposes of data, particularly personal data.
- Non-compliance fines are substantial, reaching up to €35 million or 7% of global annual turnover.
- The Act specifies implementation timelines for different systems and deadlines for developing codes of practice.